here are the log files
Client
C:\Program Files\Symantec\Ghost\ngctw32.exe 11.0.2.1573
12:17:49 PM Tuesday, 15 July 2008
Checking for Sysprep. Process id: 620, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SMSS.EXE
Checking for Sysprep. Process id: 668, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\CSRSS.EXE
Checking for Sysprep. Process id: 692, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\WINLOGON.EXE
Checking for Sysprep. Process id: 736, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SERVICES.EXE
Checking for Sysprep. Process id: 748, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\LSASS.EXE
Checking for Sysprep. Process id: 920, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SVCHOST.EXE
Checking for Sysprep. Process id: 988, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SVCHOST.EXE
Checking for Sysprep. Process id: 1084, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SVCHOST.EXE
Checking for Sysprep. Process id: 1208, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SVCHOST.EXE
Checking for Sysprep. Process id: 1280, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SVCHOST.EXE
Checking for Sysprep. Process id: 1408, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SPOOLSV.EXE
Checking for Sysprep. Process id: 1460, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SCARDSVR.EXE
Checking for Sysprep. Process id: 1556, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\COMMON FILES\AUTODESK SHARED\SERVICE\ADSKSCSRV.EXE
Checking for Sysprep. Process id: 1588, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE
Checking for Sysprep. Process id: 1656, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE
Checking for Sysprep. Process id: 1740, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\AUTODESK\3DS MAX 2008\MENTALRAY\SATELLITE\RAYSAT_3DSMAX2008_32SERVER.EXE
Checking for Sysprep. Process id: 1824, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL.1\MSSQL\BINN\SQLSERVR.EXE
Checking for Sysprep. Process id: 1972, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\DANWARE DATA\NETOP SCHOOL\TEACHER\NHOSTSVC.EXE
Checking for Sysprep. Process id: 2012, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\NVSVC32.EXE
Checking for Sysprep. Process id: 224, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\MICROSOFT SQL SERVER\90\SHARED\SQLBROWSER.EXE
Checking for Sysprep. Process id: 248, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\MICROSOFT SQL SERVER\90\SHARED\SQLWRITER.EXE
Checking for Sysprep. Process id: 344, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\HHVCDV7SYS\VC7SECS.EXE
Checking for Sysprep. Process id: 432, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\NIPALSM.EXE
Checking for Sysprep. Process id: 1060, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\ALG.EXE
Checking for Sysprep. Process id: 1384, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\EXPLORER.EXE
Checking for Sysprep. Process id: 2208, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\ANALOG DEVICES\CORE\SMAX4PNP.EXE
Checking for Sysprep. Process id: 2308, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\ITUNES\ITUNESHELPER.EXE
Checking for Sysprep. Process id: 2384, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\HHVCDV7SYS\VC7PLAY.EXE
Checking for Sysprep. Process id: 2412, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\JAVA\JRE1.6.0_05\BIN\JUSCHED.EXE
Checking for Sysprep. Process id: 2420, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\CYBERLINK\POWERDVD\PDVDSERV.EXE
Checking for Sysprep. Process id: 2432, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\SCANSOFT\OMNIPAGEPRO11.0\OPWARE32.EXE
Checking for Sysprep. Process id: 2472, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\SCANSOFT\OMNIPAGE15.0\OPWARE15.EXE
Checking for Sysprep. Process id: 2588, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\ADOBE\ACROBAT 8.0\ACROBAT\ACROTRAY.EXE
Checking for Sysprep. Process id: 2616, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\ACTIV SOFTWARE\ACTIVDRIVER\ACTIVCONTROL2.EXE
Checking for Sysprep. Process id: 2696, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\RUNDLL32.EXE
Checking for Sysprep. Process id: 2704, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\CTFMON.EXE
Checking for Sysprep. Process id: 2712, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NMBGMONITOR.EXE
Checking for Sysprep. Process id: 2748, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NMINDEXSTORESVR.EXE
Checking for Sysprep. Process id: 2832, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\IPOD\BIN\IPODSERVICE.EXE
Checking for Sysprep. Process id: 3172, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\COMMON FILES\MACROVISION SHARED\FLEXNET PUBLISHER\FNPLICENSINGSERVICE.EXE
Checking for Sysprep. Process id: 3616, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NMINDEXINGSERVICE.EXE
Checking for Sysprep. Process id: 2456, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\CMD.EXE
Checking for Sysprep. Process id: 580, name: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\MSIEXEC.EXE
Checking for Sysprep. Process id: 364, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\SYMANTEC\GHOST\NGCTW32.EXE
Checking for Sysprep. Process id: 740, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\SYMANTEC\GHOST\NGTRAY.EXE
Checking for Sysprep. Process id: 672, name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\SYMANTEC\GHOST\NGCTW32.EXE
#\Locate{ Name = (), Have = (Session), Signature = (#[0x10 0x47 0x83 0xD7 0x50 0xA3 0x05 0xC0 0xEF 0x48 0x00 0xD4 0x69 0xD1 0xA1 0x50 0x14 0x63 0xAF 0x97 0x39 0xE8 0x6C 0xBC 0x38 0xA0 0x7C 0xF9 0x01 0x8E 0xB9 0x3E 0xC7 0x9F 0x38 0x76 0x28 0xEF 0x52 0x7F 0xF2 0xFA 0x6C 0x80 0x81 0x73 0xF1 0x8A 0x46 0xA4 0xF0 0xD7 0x7A 0x6C 0x37 0x49 0x56 0x9A 0xD0 0x68 0x4B 0x18 0x94 0x84 0x5C 0x20 0x91 0x05 0xBE 0xE7 0x4E 0xB9 0xB2 0x32 0x81 0xC6 0xAB 0x2B 0xE4 0xAB 0xB1 0xA2 0x2A 0x3B 0xEA 0x8F 0x1B 0xF1 0xF7 0x70 0x52 0x8A 0x5F 0x33 0xB5 0x16 0x68 0xB6 0xD8 0x2E 0x92 0x34 0x29 0xF2 0xA6 0x7D 0x5E 0x1A 0x8F 0xE1 0xFE 0xF8 0x73 0x74 0x5A 0x3F 0x27 0x1F 0x28 0x48 0xD8 0xDA 0x05 0x20 0xF5 0x39 0x1F 0x41] . #[0x15 0xB3 0x9B 0x64 0xB7 0x0E 0x41 0x9C 0x30 0x1C 0x6E 0x00 0x03 0xDC 0xA1 0x70 0xFB 0xBF 0xD1 0xF3 0x3F 0x5D 0x90 0x72 0xB9 0xEF 0x58 0x8F 0x0F 0x7F 0xD6 0xC8 0x41 0xF1 0xE6 0x80 0xEF 0xC7 0x44 0xF5 0xCE 0x02 0x2B 0x85 0x4B 0x94 0xC3 0x27 0x90 0x7C 0x19 0xBD 0xFE 0x8F 0x3F 0x30 0x1F 0xA6 0xA2 0x85 0x04 0xAB 0x7F 0xFB 0x28 0x96 0xE8 0x45 0x5F 0xF4 0x07 0x86 0x24 0x4C 0xF9 0x52 0x7B 0xB2 0x1C 0xD5 0x52 0x21 0xA6 0x8C 0x4F 0x8C 0xF1 0xA8 0xB6 0xE0 0xEC 0x58 0x29 0x9A 0xAE 0xFE 0x0E 0x1A 0x4C 0x0D 0xF0 0x22 0xDA 0xF7 0xE6 0x11 0x96 0x2D 0xC7 0xC1 0x72 0x98 0xB8 0x64 0x9E 0x00 0x69 0x8E 0x93 0xB1 0xCB 0x7A 0xF3 0x70 0xAF 0xB2 0xC0 0x8A]), Certificate = (#[0x17 0xC7 0x8F 0x7B 0xBD 0x48 0x95 0x79 0x28 0x5B 0x2B 0x2F 0x80 0x12 0xA3 0x78 0xE7 0x32 0x14 0x2B 0x6B 0x86 0xCE 0x39 0x9D 0xA6 0xC0 0x08 0x2A 0x96 0x7F 0x87 0xBB 0xFF 0xDD 0x98 0x44 0xF3 0xB3 0x16 0x79 0x9B 0x73 0xEC 0xC3 0x9C 0xC7 0x42 0xFA 0x90 0x62 0x58 0x10 0x52 0x94 0xC7 0x71 0x05 0xC0 0xB8 0x84 0x40 0x1E 0x44 0x32 0x41 0x67 0x9E 0x98 0x6C 0x5D 0x95 0x98 0x00 0x86 0x28 0x1E 0x1E 0x43 0x7C 0xC1 0x39 0x3C 0x38 0xDB 0x0A 0x40 0x17 0xBE 0x24 0x78 0x8B 0xCF 0xC0 0x49 0x2F 0x47 0x89 0x0E 0x72 0x1E 0xE9 0xF6 0x6C 0x4E 0x4F 0x4C 0x5F 0x6C 0xFA 0xB3 0x97 0x83 0x46 0x97 0xB8 0x65 0xBC 0x20 0xAB 0x93 0xF4 0x40 0x6A 0xE5 0xCE 0xBD 0xC5] . #[0x1B 0x46 0x8C 0x50 0xEC 0xA8 0xF5 0xB4 0x31 0x56 0x72 0xFA 0xA7 0xC1 0xDE 0xB1 0xFF 0xC9 0x19 0xDE 0xA4 0xE8 0x2B 0x23 0x11 0xEA 0x6F 0x0E 0xB2 0x74 0x32 0xC3 0x3E 0xA0 0xFA 0x0F 0xB2 0x31 0x45 0x7D 0x47 0xAD 0x8E 0xC9 0x49 0x61 0x49 0xDC 0xD8 0xED 0xF0 0xB3 0xC1 0xF4 0x4C 0x27 0x81 0xF9 0xA9 0x99 0x0F 0x58 0x4C 0x7A 0x7F 0x7D 0xB7 0x9C 0x56 0x8D 0x3F 0xDF 0x2E 0xC2 0x8C 0xB2 0x52 0x75 0x52 0x0D 0xAE 0x25 0xA9 0x14 0xCA 0x0F 0x17 0x95 0xED 0x13 0xE6 0x23 0x0C 0xE5 0x47 0x82 0x9B 0xB8 0x63 0xF5 0x79 0xB2 0xCF 0x29 0x3C 0x25 0x75 0x9A 0xF8 0x45 0x13 0xC5 0x85 0x92 0x64 0xE6 0x8A 0x5A 0x6E 0x03 0x23 0x6B 0x7C 0x2A 0x4C 0x6A 0x0D 0x30]), Response = #[0xCC 0x3F 0x95 0x97 0x92 0x20 0x80 0x79], Public = #[0x07 0x16 0x43 0xED 0x03 0x2D 0x19 0x2D 0x12 0x4D 0xB9 0x59 0x9B 0xC1 0x03 0x55 0x02 0x05 0x60 0x2C 0x79 0xF1 0x5D 0xB2 0xD3 0x96 0x49 0x57 0x4D 0xDC 0xC5 0x2C 0xE6 0x89 0x93 0x91 0x5C 0xFA 0xDF 0x0E 0xF6 0x7A 0x8C 0x9D 0x4B 0x93 0x44 0xD2 0x87 0x57 0x22 0xAC 0x70 0x44 0x5B 0xBF 0x7B 0x8E 0xBC 0xEA 0x82 0x52 0x59 0x77 0x6F 0xC6 0x08 0xDE 0xE8 0xD1 0xB6 0x1C 0x4B 0x5D 0xB4 0xCC 0x8D 0x6D 0xB9 0x45 0x47 0xEB 0x39 0x6D 0xFD 0xDD 0x15 0x22 0x4B 0x1A 0xE1 0x8E 0x2F 0x93 0x72 0x91 0xF8 0xAF 0x22 0x8A 0x0E 0x22 0xAB 0x1D 0xEE 0xAC 0xD0 0x42 0x3F 0x6D 0xA3 0x59 0x03 0x0B 0x0C 0x09 0x53 0x49 0x27 0x67 0x52 0x22 0x2F 0x7D 0x15 0xC8 0xC6 0xB4], IPADDRESS = 167852136, Product = Ghost, Host = mercury, Address = 1347, Component = Config_Server, Generator = #[0x15 0xA6 0x3C 0x65 0xF2 0xEC 0xB2 0x23 0xC5 0xAF 0xF1 0x73 0x2A 0x69 0xCF 0xE6 0x50 0x03 0x4A 0xDD 0x28 0x8C 0xB0 0x4F 0x0C 0xD2 0xC3 0xEB 0x93 0x88 0x30 0xE9 0xA6 0x4E 0xC7 0x09 0xD5 0xCB 0x1C 0x93 0xE0 0x07 0x90 0x52 0x75 0x65 0x20 0x10 0x7E 0xD1 0xCE 0x73 0x2F 0xF9 0x6F 0x0F 0x20 0xD2 0xDE 0x73 0x3D 0xA0 0x9C 0xC9 0xD9 0x03 0xD7 0x6E 0x2C 0x7B 0xD4 0xFB 0x28 0xD9 0x6E 0x3C 0x5C 0xB1 0x69 0x26 0x00 0x59 0x4F 0x75 0x7C 0xA4 0x04 0x69 0x8F 0xF2 0xDD 0xF6 0xA7 0x7E 0x7C 0x49 0xB1 0xC3 0xD0 0x71 0x5C 0xED 0xC2 0x1E 0xFB 0x06 0x0B 0x2A 0x72 0x50 0x4D 0xCC 0x8F 0xB8 0xDE 0x77 0xE3 0x4A 0x9E 0x3A 0xBD 0x2D 0xA0 0x9B 0x5C 0x7A 0x6B 0x40], Challenge = #[0x07 0x79 0xA3 0x4D 0x97 0x0B 0x15 0x59], Modulus = #[0x24 0x64 0xA5 0xD8 0xDD 0x7F 0xFF 0x0F 0xA7 0xED 0xD9 0xC1 0xD0 0x1A 0x42 0xC9 0x1E 0x0C 0x04 0xCF 0x58 0xD4 0xA4 0x65 0xB6 0xE6 0xB7 0x45 0x10 0xB0 0xC3 0x26 0x69 0xC2 0xC1 0xEA 0x09 0xBE 0xFF 0xDD 0x7B 0x18 0x78 0x2F 0x4F 0xC0 0x13 0x31 0x68 0x41 0x5B 0x82 0xA3 0xC8 0xF3 0x4D 0x32 0xDD 0xC4 0xA8 0x8B 0x0B 0xDE 0x21 0xEC 0x22 0x35 0x8D 0xE6 0x1C 0x74 0x97 0x4B 0x9E 0x85 0x06 0xE7 0x34 0xF6 0xCE 0xD7 0x35 0xEB 0x38 0xAC 0x18 0x0B 0x7C 0x3D 0xAE 0x93 0x04 0xC0 0x1E 0xF8 0x5B 0x93 0xA7 0x82 0x6A 0xD3 0x87 0x0F 0x4E 0x93 0xCC 0xB6 0xCB 0xE1 0xD3 0x47 0x94 0xDE 0xF1 0x0F 0xFF 0xE2 0x6A 0x9F 0x07 0xD0 0xA6 0x87 0xCD 0x21 0x05 0x9E 0xD3], Session = (1812343263 #[0x1B 0xAD 0xE2 0x34 0x20 0xEB 0xF9 0xBB 0xC3 0x70 0xC6 0x12 0x8A 0x5F 0x35 0x4D 0x8C 0x27 0x71 0xAF 0x48 0xE9 0xC1 0x67 0xDE 0x4B 0x7B 0x75 0x2E 0xC1 0x0D 0x68 0xA5 0xDE 0xB4 0x03 0x06 0x04 0xFA 0xDD 0x30 0x02 0xB8 0x60 0x3C 0x8B 0x3F 0x0F 0xBB 0x0F 0x9A 0x74 0x54 0x39 0xA9 0x14 0xFF 0x31 0x67 0x6B 0x2B 0x41 0xAF 0xE9 0xE1 0x71 0x2C 0xBE 0x64 0x9E 0xEB 0x14 0x30 0x8F 0x7C 0x63 0xEB 0x80 0xE7 0x8E 0x33 0x5D 0xE6 0x60 0x03 0xC4 0x43 0x85 0xB3 0x76 0x11 0x79 0xBA 0xE8 0x76 0x84 0x81 0xA5 0x76 0xEB 0x82 0xEC 0xF6 0x5C 0x53 0x06 0x38 0xBE 0xF2 0x58 0x86 0xE2 0xB6 0xE8 0x96 0xDA 0xD3 0xA5 0x74 0x82 0x0D 0x21 0xC3 0xE7 0x28 0xB1 0x47 0xBD]) }
Found server IP in ARP cache
12:17:50 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:17:50 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:17:50 PM 10.1.56.104:1346 TCP connecting to 10.1.110.2:1347
Received message #\Session{ Status = #true }
Received message #\Folder{ }
Received message #\HasGhostBootPartition{ }
Received message #\Open{ What = Configuration, Mode = Read }
12:17:50 PM 10.1.56.104:1346 disconnecting from 10.1.110.2:1347
12:18:10 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:18:10 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:18:30 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:18:30 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:18:50 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:18:50 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:19:10 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:19:10 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:19:30 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:19:30 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:19:50 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:19:50 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:20:10 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:20:10 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:20:30 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:20:30 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:20:50 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:20:50 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:21:10 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:21:10 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:21:30 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:21:30 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:21:50 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:21:50 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:22:10 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:22:10 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:22:10 PM 10.1.56.104:1346 TCP connecting to 10.1.110.2:1347
Received message #\Session{ Status = #true }
Received message #\Hash{ Name = ("pubkey.crt") }
Hashed ("pubkey.crt") to { pubkey\.crt = #[0xDF 0x2B 0x18 0xE4 0xB8 0x37 0xF2 0x1A 0xC6 0xAF 0x66 0x6B 0x40 0xAC 0x30 0xC4] }
Received message #\Open{ Name = "pubkey.crt", What = File, Mode = Write }
Received message #\HasGhostBootPartition{ }
Received message #\taskInProgess{ Cancel = 1 }
Received message #\HasGhostBootPartition{ }
Received message #\Open{ What = Configuration, Mode = Read }
Received message #\taskInProgess{ Cancel = 1 }
Received message #\PreventLoginTask{ DisableLogin = 0 }
Received message #\Shutdown{ Name = () }
12:22:10 PM 10.1.56.104:1346 disconnecting from 10.1.110.2:1347
12:22:30 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:22:30 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:42:10 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:42:30 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:42:30 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:42:30 PM 10.1.56.104:1346 TCP connecting to 10.1.110.2:1347
Received message #\Session{ Status = #true }
Received message #\Hash{ Name = ("pubkey.crt") }
Hashed ("pubkey.crt") to { pubkey\.crt = #[0x8A 0xED 0x43 0xF6 0x11 0x16 0x3A 0x42 0xBE 0xEB 0x02 0xD2 0xF6 0xBA 0x22 0x6C] }
Received message #\HasGhostBootPartition{ }
Received message #\WarnShutdown{ Shutdown = 1, Timeout = 10, Platform = DOS, Cancel = 1 }
12:42:30 PM 10.1.56.104:1346 disconnecting from 10.1.110.2:1347
12:42:50 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347
12:42:50 PM 10.1.56.104:1346 acknowledged by 10.1.110.2:1347
12:42:50 PM 10.1.56.104:1346 TCP connecting to 10.1.110.2:1347
Received message #\Session{ Status = #true }
Received message #\WarnShutdown{ Shutdown = 1, Timeout = 10, Platform = DOS, Cancel = 1 }
Received message #\WORKGROUP{ }
Received message #\Hash{ Name = ("ghost.exe" "ghstwalk.exe" "ghconfig.exe") }
Hashed ("ghost.exe" "ghstwalk.exe" "ghconfig.exe") to { GhConfig\.exe = #[0x60 0x89 0x8B 0xA7 0x34 0x2A 0x74 0x4C 0xF0 0x04 0x5E 0x3B 0x5C 0x93 0xBD 0xFC] }
Received message #\Open{ Name = "ghstwalk.exe", What = File, Mode = Write }
Received message #\Open{ Name = "ghost.exe", What = File, Mode = Write }
Received message #\GetNetworkDriverCRC{ Name = "incoming\\dos" }
Received message #\DeleteClientDirectory{ Name = "incoming\\dos" }
Received message #\GetNetworkDriverCRC{ Name = "incoming\\dos" }
Received message #\Open{ Name = "incoming\\dos\\IBMDOS.COM", What = File, Mode = Write }
Received message #\Open{ Name = "incoming\\dos\\IBMBIO.COM", What = File, Mode = Write }
Received message #\Open{ Name = "incoming\\dos\\command.com", What = File, Mode = Write }
Received message #\Open{ Name = "incoming\\dos\\bootsect.dat", What = File, Mode = Write }
Received message #\Open{ Name = "incoming\\dos\\bootsect-floppy.dat", What = File, Mode = Write }
Received message #\GetNetworkDriverCRC{ Name = "incoming\\template" }
Received message #\DeleteClientDirectory{ Name = "incoming\\template" }
Received message #\GetNetworkDriverCRC{ Name = "incoming\\template" }
Received message #\Open{ Name = "incoming\\template\\protocol.ini", What = File, Mode = Write }
Received message #\Open{ Name = "incoming\\template\\mcassist.cfg", What = File, Mode = Write }
Received message #\Open{ Name = "incoming\\template\\B57.dos", What = File, Mode = Write }
Received message #\UpdateProtocolIni{ Name = "incoming\\template/protocol.ini", ServerConnectionDeviceId = "" }
Received message #\taskInProgess{ Cancel = 1 }
Received message #\PreventLoginTask{ DisableLogin = 0 }
Received message #\Shutdown{ Name = () }
12:42:51 PM 10.1.56.104:1346 disconnecting from 10.1.110.2:1347
12:43:10 PM 10.1.56.104:1346 sending status to 10.1.110.2:1347